A predictive model doesn’t break all at once. It drifts out of tune while still returning numbers with the same confidence as ever. Machine learning governance is what stops a company from making decisions with a model that stopped being valid eight months ago without anyone noticing.
It’s the second layer of AI governance. Below it sits data, without which no model is possible; above it, generative AI and agents, which raise different problems.
What exactly gets governed
The inventory. Which models are in production, what each one decides, what data it was trained on, who owns it, and when it was last reviewed. Many companies don’t have this list, and the project’s first surprise is finding out how many models are live.
Pre-deployment validation. No model goes into production without acceptance criteria agreed with the business: what error is tolerable, in which segments, and what happens with cases the model has never seen.
Drift. Input data changes — the market shifts, the catalog changes, the way things get recorded changes — and performance drops without warning. We monitor both input distributions and actual versus predicted outcomes, with thresholds that trigger a review.
Retraining. How often, with what data, who approves it, and how to roll back if the new model is worse. Automatic retraining without validation is an elegant way to break the system.
Traceability. Being able to reconstruct why the model decided what it did on a given date: version, data, parameters, and thresholds. It’s what you’ll be asked for when a customer complains or a regulator comes calling.
End of life. When a model gets retired. Models nobody uses that keep running are pure cost and silent risk.
How it differs from data governance
Data governance answers is what I have reliable?; machine learning governance answers is what I infer from it still valid? You can have flawless data and an outdated model — or a well-maintained model learning from dirty data. They’re two separate controls, and neither replaces the other.
Where it meets regulation
The EU AI Act doesn’t regulate “models” in the abstract; obligations depend on use. A model involved in hiring, credit decisions, or access to essential services is high-risk and requires risk management, technical documentation, logging, and human oversight. Much of that documentation is exactly what good model governance produces; building it later, in a rush, costs far more. The regulatory details are in AI compliance and governance.
When to set it up — and when it’s premature
Yes, when you have more than two or three live models, when any of them influences decisions with consequences for people or money, or when the team that built them is no longer the one maintaining them.
Not yet, when there’s a single model in pilot and the priority is proving it adds value. At that stage, it’s enough to record what was done so you don’t have to rebuild it from memory later.
How we approach it
We start with the inventory, which almost always turns up more models than expected — and some with no owner. Then we set acceptance criteria with the business (not just the technical team) and instrument drift monitoring on the models that matter most. The goal isn’t a heavy process. It’s that nobody has to answer “I don’t know” when asked which models exist, what they decide, and who owns them.
Frequently asked questions
Isn’t this just MLOps? MLOps is the machinery — deployment, versioning, monitoring — and has its own page. Governance is about who decides what’s acceptable, who’s accountable, and when to stop. It relies on MLOps, but it doesn’t end with the tooling.
How often should a model be reviewed? It depends on how fast its data changes. What doesn’t work is setting a calendar and looking at nothing between reviews: drift is monitored continuously, and a review is triggered when a threshold is crossed.
Who should own a model? A business owner of the decision the model affects, backed by a technical lead. If the data team is the only owner, nobody is accountable for the impact.